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- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- tf the period for reply specified above ts less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1)13 Responsive to communication(s) filed on 27 June 2000 & 26 October 2000 . 
2a)D This action is FINAL. 2b)S This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) S Claim(s) 1-32 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) |3 Claim(s) 1-32 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) S The specification is objected to by the Examiner. 

10) 0 The drawing(s) filed on 27 June 2000 is/are: a)|S accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) 13 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a® All b)D Some * c)D None of: 

1 Certified copies of the priority documents have been received. 

2. M Certified copies of the priority documents have been received in Application No. 132058 . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



1 . Claims 1 -32 are examined. 



Drawings 

2. Figure 1 discloses generic electronic devices and thus should be labeled as prior 
art. 



Priority 

3. Acknowledgment is made of applicant's claim for foreign priority under 35 
U.S.C. 1 19(a)-(d). The certified copy has been filed in Application No. 132058, filed on 
09/23/1999. 

Information Disclosure Statement 

4. The listing of references on pages 1 (lines 10-13); 2 (lines 3-1 1 & 26-30); 15 
(lines 6-12); and 21 (lines 24-27) in the specification is not a proper information 
disclosure statement. 37 CFR 1 .98(b) requires a list of all patents, publications, or other 
information submitted for consideration by the Office, and MPEP § 609 A (1) states, "the 
list may not be incorporated into the specification but must be submitted in a separate 
paper." However, the examiner acknowledges their presence on the 1449 and has 
considered them in the prosecution; but suggests applicants remove references from 
the specification. 
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Furthermore, reference by titled Milner-R, titled "An Algebraic Definition of Simulation 
Between Programs" was not considered because of a missing publication date. 

Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

6. Claims 1-32 are rejected under 35 U.S.C. 102(b) as being anticipated by Katz et 
al., ("Have I Written Enough Properties"— A Method of Comparison Between 
Specification and Implementation (1998)). 

Katz et al. teaches a primary analysis of model checking (pg. 1 , lines 1-2). 

Claim 1 . A method for verification, comprising: providing an implementation model, 
which defines model states of a target system and model transitions between the model 
states; providing a specification of the target system (pg. 1 , paragraphs 3 and 4), 
comprising properties that the system is expected to obey; creating a tableau from the 
specification, the tableau defining tableau states with tableau transitions between the 
tableau states in accordance with properties (pg. 1, lines 12-13; and pg. 4, section 3.2 
1 st paragraph); and comparing the tableau transitions to the model transitions to 
determine whether a discrepancy exists there between. 
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Claim 2. A method according to claim 1, wherein creating the 2 tableau comprises (pg. 
4, section 3.2, lines 1-20) defining a finite state machine using a hardware description 
language (pg. 5, lines 8-28). 

Claim 3. A method according to claim 2, wherein the implementation model has model 
inputs and outputs, and wherein defining the finite state machine (pg. 1 , lines 12-13) 
comprises describing a virtual device having inputs and outputs corresponding to the 
model inputs and outputs of the implementation model (pg. 1, paragraph 5; and page 2). 

Claim 4. A method according to claim 3, wherein comparing the transitions comprises 
performing a reachability analysis (pgs. 3 and 4, section 3.1, Reachable Simulation) 
using both the implementation model and the tableau while providing identical inputs to 
the inputs of both the implementation model and the tableau, and verifying that the 
outputs are always identical (pg. 7, section 4.3). 

Claim 5. A method according to claim 4, wherein performing the reachability analysis 
comprises comparing the model and the tableau automatically using a model checker 
(pg. 8 and 9, section 5.1 .3). 

Claim 6. A method according to claim 4, wherein performing the reachability analysis 
comprises providing evidence of a tableau transition that is not implemented in the 
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model (pg. 8, section 5.1.3, Unimplemented Transition and pg. 4, section 3.2, lines 9- 
14)). 

Claim 7. A method according to claim 1, wherein comparing the tableau transitions 
comprises associating model transitions with corresponding tableau transitions (pg. 1, 
line 8 and pg. 7, section 5.0, steps 1-4). 

Claim 8. A method according to claim 7, wherein associating the transitions comprises 
defining a reachable simulation preorder relating the model (pg. 3, lines 13-17) and the 
tableau. 

Claim 9. A method according to claim 7, wherein associating the transitions comprises 
finding a tableau transition that is not implemented in the model (pg. 8, section 5.1.3, 
Unimplemented Transition). 

Claim 10. A method according to claim 9, wherein finding the tableau transition that is 
not implemented in the model comprises deriving an indication, based on the 
unimplemented transition, that the specification is not complete with respect to the 
model (pg. 4, section 3.2, lines 5-8). 

Claim 1 1 . A method according to claim 9, wherein finding the tableau transition that is 
not implemented in the model comprises deriving an indication, based on the 
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unimplemented transition, that a transition of the target system is missing in the model 
(pg. 4, section 3.2, lines 9-14). 

Claim 12. A method according to claim 1, and comprising associating model states with 
corresponding tableau states (pg. 1, line 8 and pg. 7, section 5.0, steps 1-4). 

Claim 13. A method according to claim 12, wherein associating the model states with 
the corresponding tableau states comprises finding a tableau state that is not 
implemented in the model (pg. 5, lines 1-5). 

Claim 14. A method according to claim 13, wherein finding the tableau state that is not 
implemented in the model comprises deriving an indication, based on the 
unimplemented state, that the specification is not complete with respect to the model 
(pg. 4, lines 5-8). 

Claim 15. A method according to claim 13, wherein finding the tableau state that is not 
unimplemented in the model comprises deriving an indication, based on the 
unimplemented state, that a state of the target system is missing in the model (pg. 7, 
section 4.3, lines 4-6). 
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Claim 16. A method according to claim 12, wherein associating the model states with 
the corresponding tableau states comprises finding multiple model states corresponding 
a single tableau state (pg. 10, section 6.1, lines 1-19). 

Claim 17. A method according to claim 1, wherein creating the tableau comprises 
creating a reduced tableau from which one or more redundant states have been 
eliminated (pg. 10, lines 7-9). 

Claim 18. A method according of claim 1 , wherein comparing the transitions comprises 
verifying that the specification is a complete and correct description of the 
implementation model responsive to the comparison (pg. 6, section 4.1, Transition 
Evidence). 

Claim 19. A verification processor, which is configured to receive an implementation 
model, defining model states of a target system and model transitions between the 
model states (pgs. 1 and 2, paragraph 5 and 1, respectively) and to receive a 
specification of the target system, including properties that the system is expected to 
obey, and which is operative to create a tableau from the specification, the tableau 
defining tableau states with tableau transitions between the tableau states in 
accordance with the properties, and to compare the tableau transitions (pg. 1, lines 12- 
13; and pg. 4, section 3.2 1 st paragraph) to model transitions to determine whether a 
discrepancy exists there between. 
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Claim 20. A processor according to claim 19, which is operative to perform model 
checking of the implementation model (pg. 3, section 3.1, lines 4 and pg. 4, lines 1-3) 

Claim 21 . A computer software product for verification of a specification of a target 
system, which specification includes properties that the system is expected to obey, by 
comparison with an implementation model (pg. 1, lines 17-22) which defines model 
states between the model states, the product comprising a computer-readable medium 
having computer program instructions recorded therein, which instructions, when read 
by a computer (pg. 9, lines 6-7), cause the computer to create a tableau from the 
specification, the tableau defining tableau states with tableau transitions (pg. 1, lines 12- 
13; and pg. 4, section 3.2 1 st paragraph) between the tableau states in accordance with, 
the properties, and to compare the tableau transitions to the model transitions to 
determine whether a discrepancy exists there between. 

Claim 22. A product according to claim 21 , wherein the program instructions cause the 
computer to compare the tableau with the model by running a reachability analysis 
using both the implementation model and the tableau while providing identical inputs to 
the inputs of both the implementation model and the tableau, and verifying that the 
outputs are always identical (pgs. 3-4, section 3.1) 
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Claim 23. A product according to claim 22, wherein reachability analysis is performed 
using an automatic model checker (pg. 9, section 5.2, lines 4-7). 

Claim 24. A product according to claim 21, wherein the instructions cause the computer 
to verify that the specification is a complete description of the implementation model 
(pg. 1, lines 26-30). 

Claim 25. A method for verification, comprising: providing an implementation model, 
which defines model states of a target system and model transitions between the model 
states; providing a specification of the target system (pgs. 1 and 2, paragraph 5 and 1 , 
respectively), comprising properties that the system is expected to obey; creating a 
tableau from the specification, the tableau defining tableau states with tableau 
transitions between the tableau states in accordance with the properties (pg. 1, lines 12- 
13; and pg. 4, section 3.2 1 st paragraph); and comparing the model and the tableau by 
inputting the model and the tableau to an automatic model checking program. 

Claim 26. A method according to claim 25, wherein creating the tableau comprises (pg. 
4, section 3.2, lines 1-20) defining a finite state machine using a hardware description 
language. 

Claim 27. A method according to claim, 26, wherein the input model has model inputs 
and outputs, and wherein defining the finite state machine comprises describing (pg. 5, 
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lines 8-28) a virtual device having inputs arid outputs corresponding to the model inputs 
and outputs of the implementation model. 

Claim 28. A method according to claim 27, wherein comparing the model and the 
tableau comprises running the model checker while providing identical inputs (pg. 5, 
section 4 Example, lines 1-28) to the inputs of both the implementation model and the 
tableau, and verifying that the outputs are always identical. 

Claim 29. A method according to claim 25, wherein comparing the model and the 
tableau comprises providing evidence of a transition or state in the tableau that is not 
implemented in the model (pg. 7, section 4.3). 

Claim 30. A method according to claim 29, wherein providing the evidence comprises 
providing a counter-example indicative of the unimplemented transition or state (pg. 7, 
section 4.4). 

Claim 31 . Model checking apparatus, which is configured to receive an implementation 
model, defining model states of a target system and model transitions between the 
model states, and to receive a specification of the target system (pg. 1 , paragraphs 3. 
and 4), including properties that the system is expected to obey, and which is operative 
to create a tableau from the specification, the tableau defining tableau states with 
tableau transitions between the tableau states in accordance with the properties (pg. 1, 
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lines 12-13; and pg.4, section 3.2 1 st paragraph) and to compare the tableau to the 
model by inputting the model and the tableau to an automatic model checking program 
(pg.9, section 5.2, lines 4-7). 

Claim 32. A computer software product for verification of a specification of a target 
system (pg. 1, paragraphs 3 and 4), which specification includes properties that the 
system is expected to obey, by comparison with an implementation model, which 
defines model states of the target system and model transitions between the model 
states, the product comprising a computer-readable medium having computer program 
instructions recorded therein, which instructions, when read by a computer (pg. 9, lines 
4-9), cause the computer to create a tableau from the specification, the tableau defining 
tableau states with tableau transitions between the tableau states(pg. 1, lines 12-13; 
and pg. 4, section 3.2 1 st paragraph) in accordance with the properties, and to compare 
the tableau to the model by inputting the model and the tableau to an automatic model 
checking program. 

Correspondence Information 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Tom Stevens whose telephone number is (703) 305- 
0365, Monday-Friday (8:30 am- 5:30 pm) or contact Supervisor Mr. Kevin Teska at 
(703) 305-9704. The fax number for the group is 703-872-9306. 
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Any inquires of general nature or relating to the status of this application should 
be directed to the Group receptionist whose phone number is (703) 305-3900. 



May 12, 2004 



